SB2026070660 - Multiple vulnerabilities in libevent

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070660

SB2026070660 - Multiple vulnerabilities in libevent

Published: July 6, 2026

Security Bulletin ID SB2026070660
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 9% Medium 64% Low 27%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in bufferevent_socket_set_conn_address_ when processing AF_UNIX accept() results for peer socket addresses. A remote attacker can connect to a vulnerable Unix domain socket with a specially crafted abstract-namespace address to execute arbitrary code.

On builds with NDEBUG, the assertion guarding the copy is disabled. Exploitation requires access to connect to the application's AF_UNIX listener, and on pthread-enabled servers the overwrite can corrupt a lock pointer that is later dereferenced inside libc.


2) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or corrupt adjacent stack state.

The vulnerability exists due to stack-based buffer overflow in dnsname_to_labels() in evdns.c when formatting DNS server responses containing name-bearing records. A remote attacker can send a specially crafted DNS query that causes the application to generate a crafted response to cause a denial of service or corrupt adjacent stack state.

The issue is triggered by an off-by-one condition when name encoding reaches the exact end of a 64 KB stack buffer before a terminating null byte is appended.


3) Inconsistent interpretation of HTTP requests (CVE-ID: N/A)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass access controls.

The vulnerability exists due to inconsistent interpretation of HTTP requests in evhttp_decode_uri_internal when processing percent-encoded URIs. A remote attacker can send a specially crafted request containing a %00 sequence to bypass access controls.

The issue arises because a decoded NUL byte can truncate the path for subsequent C string operations.


4) Inconsistent interpretation of HTTP requests (CVE-ID: N/A)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject headers.

The vulnerability exists due to inconsistent interpretation of HTTP requests in evhttp_header_is_valid_value when handling folded header lines. A remote attacker can send a specially crafted request containing obs-fold sequences to inject headers.

Exploitation depends on a proxy chain where the frontend rejects obs-fold but the libevent backend accepts it.


5) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer truncation in evtag_unmarshal_header() and evtag_unmarshal_string() when parsing crafted wire-encoded length fields. A remote attacker can send specially crafted input with a length value above INT_MAX to cause a denial of service.

The issue is triggered when a wire uint32 length is converted to a signed int, causing negative or truncated values that lead to an oversized wrapped allocation request in downstream string unmarshalling.


6) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_tag_internal() when parsing a malformed fragmented evbuffer tag. A remote attacker can send specially crafted input with more than 5 continuation bytes to cause a denial of service.

The issue is reachable through evtag_unmarshal_header(), and potential higher-level reachability exists via evrpc request parsing.


7) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests and bypass access controls.

The vulnerability exists due to improper input validation in the evhttp HTTP parser when processing requests with multiple Transfer-Encoding headers. A remote attacker can send a specially crafted request with conflicting Transfer-Encoding headers to smuggle HTTP requests and bypass access controls.

Exploitation requires the service to be deployed behind an intermediary that interprets Transfer-Encoding differently and reuses the connection.


8) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests and bypass access controls.

The vulnerability exists due to improper input validation in the evhttp HTTP parser when processing requests with multi-valued Transfer-Encoding headers. A remote attacker can send a specially crafted request with a comma-separated Transfer-Encoding value to smuggle HTTP requests and bypass access controls.

Exploitation requires the service to be deployed behind an intermediary that recognizes chunked as the final transfer coding and reuses the connection.


9) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests and disclose sensitive information.

The vulnerability exists due to improper input validation in chunked body parsing in evhttp when parsing chunked transfer coding with bare LF line terminators. A remote attacker can send a specially crafted chunked request using bare LF terminators to smuggle HTTP requests and disclose sensitive information.

Exploitation depends on parser differentials with an intermediary that strictly requires CRLF or otherwise interprets chunk boundaries differently.


10) Expired pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a dangling pointer in evbuffer_add_buffer_reference when handling a buffer state where out_total_len == 0. A remote attacker can trigger a specific sequence of buffer operations to disclose sensitive information.

The issue was found by fuzzing, and exploitation appears to require a specific sequence of buffer operations.


11) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP headers.

The vulnerability exists due to improper input validation in the evhttp_read_trailer function in http.c when processing HTTP trailer fields in chunked encoded requests. A remote attacker can send a specially crafted chunked HTTP request with malicious trailer headers to smuggle HTTP headers.

This can lead to request desynchronization, cache poisoning, access control bypass, or host header manipulation in deployments that trust or process the merged headers.


Remediation

Install update from vendor's website.

References